PT-2003-2185 · Cutenews · Cutenews

Published 2003-12-31 · Updated 2008-09-05 · CVE-2003-1240

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CuteNews version 0.88

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter in files such as "shownews.php", "search.php", or "comments.php".

Recommendations For CuteNews version 0.88, consider restricting access to the cutepath parameter in the affected files until a patch is available. Avoid using the cutepath parameter in the API endpoints "shownews.php", "search.php", or "comments.php" to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2003-1240

Affected Products

Cutenews

References · 7

• 🔥 https://exploit-db.com/exploits/22284 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2003-02/0320.html · Exploit
• 🔥 https://exploit-db.com/exploits/22285 · Exploit
• 🔥 http://securityfocus.com/bid/6935 · Exploit
• 🔥 https://exploit-db.com/exploits/22283 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1240 · Security Note
• http://iss.net/security_center/static/11417.php · Note